Static task
static1
Behavioral task
behavioral1
Sample
32e197e60a28d0075ddad1b6b83e85045db3ebb4fdb64f1cad4876e0435314af.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
32e197e60a28d0075ddad1b6b83e85045db3ebb4fdb64f1cad4876e0435314af.exe
Resource
win10v2004-20231023-en
General
-
Target
32e197e60a28d0075ddad1b6b83e85045db3ebb4fdb64f1cad4876e0435314af
-
Size
132KB
-
MD5
9d47a9d1f3649b89d404b7edd55b7270
-
SHA1
6a55b8a645441b461711a0946f7b9cc3c985e92e
-
SHA256
32e197e60a28d0075ddad1b6b83e85045db3ebb4fdb64f1cad4876e0435314af
-
SHA512
c9fc6e2ed566f1a5fc1bd852d15a4d1c6d0bde64330c30b73294360c83fc47d2a664495600cc1a0b5344ac5e6378eaede26a7a80113296d5fb989f43bf8bed51
-
SSDEEP
1536:fc4ysqJW33a1XD2LZcwnj32HMWKH95bbwM0Vdw1EngPuSNl1OgGp7qw:fc4AJW3qRYcwnz2HeH9TDExSr1OgGpOw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 32e197e60a28d0075ddad1b6b83e85045db3ebb4fdb64f1cad4876e0435314af
Files
-
32e197e60a28d0075ddad1b6b83e85045db3ebb4fdb64f1cad4876e0435314af.exe windows:4 windows x86
c3d6c59247bb580821e954f40636dc80
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
gethostbyname
libnet30
?GetNumLocalIPAddrs@CSocketUtils@@SAHXZ
?GetLocalIPAddr@CSocketUtils@@SAKH@Z
kernel32
GetExitCodeProcess
LoadLibraryW
WaitForMultipleObjects
CreateThread
CreateFileW
CreateFileMappingW
ResetEvent
DeviceIoControl
MapViewOfFile
UnmapViewOfFile
CloseHandle
WideCharToMultiByte
GetLastError
SetEvent
CreatePipe
Sleep
lstrlenA
GetCurrentProcess
GetStartupInfoW
CreateProcessW
CreateEventW
GetCommandLineW
GetVersionExW
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetModuleHandleW
ReadFile
GetProcAddress
GetSystemTimeAsFileTime
MultiByteToWideChar
user32
DialogBoxParamW
LoadCursorW
LoadStringW
LoadAcceleratorsW
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
EndDialog
PostQuitMessage
KillTimer
EndPaint
BeginPaint
DefWindowProcW
DestroyWindow
RegisterClassExW
SetTimer
UpdateWindow
ShowWindow
CreateWindowExW
LoadIconW
advapi32
OpenServiceA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ControlService
QueryServiceStatus
CloseServiceHandle
StartServiceW
OpenSCManagerW
libtdmaster
StopSimulate
BeginSimulate
msvcp80
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Incref@facet@locale@std@@QAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Register@facet@locale@std@@QAEXXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?id@?$ctype@_W@std@@2V0locale@2@A
?str@?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?uncaught_exception@std@@YA_NXZ
??0?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
?widen@?$ctype@_W@std@@QBE_WD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??0_Lockit@std@@QAE@H@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??1_Lockit@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??Bid@locale@std@@QAEIXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PBX@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
??_D?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
??1locale@std@@QAE@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_N@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
log4cplusu
?getInstance@Logger@log4cplus@@SA?AV12@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??1Logger@log4cplus@@UAE@XZ
?forcedLog@Logger@log4cplus@@QBEXHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PBDH@Z
?isEnabledFor@Logger@log4cplus@@QBE_NH@Z
libelclogu
?DoConfigure@LibElcLog@ElcComponent@@YAXPB_W@Z
msvcr80
_CxxThrowException
?terminate@@YAXXZ
_crt_debugger_hook
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_controlfp_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
??3@YAXPAX@Z
free
memmove_s
_recalloc
calloc
??0exception@std@@QAE@ABQBD@Z
??_V@YAXPAX@Z
??0exception@std@@QAE@ABV01@@Z
atoi
??1exception@std@@UAE@XZ
isdigit
?what@exception@std@@UBEPBDXZ
??0bad_cast@std@@QAE@PBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
??1bad_cast@std@@UAE@XZ
_invalid_parameter_noinfo
_wtoi
??0exception@std@@QAE@XZ
_purecall
memset
fprintf
_vsnprintf_s
__CxxFrameHandler3
memcpy
memmove
isspace
tolower
isalpha
isalnum
strncmp
strchr
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
Sections
.text Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ